Genetic fuzzing for customization of security operations center rules per organization

A system comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor to perform:

• simulating operation of a security incident and event management system by running a plurality of rules of the system on labeled data;
• determining fitness metrics of the plurality of rules;
• selecting at least one rule of the plurality of rules based on the determined fitness metrics;
• modifying the selected rule to form an updated rule;
• and
• repeating running the updated rule on the labeled data, determining fitness metrics of the updated rule, and mutating the updated rule.

A computer program product comprising a non-transitory computer readable storage having program instructions embodied therewith, the program instructions executable by a computer, to cause the computer to perform a method comprising:

• simulating operation of a security incident and event management system by running a plurality of rules of the system on labeled data;
• determining fitness metrics of the plurality of rules;
• selecting at least one rule of the plurality of rules based on the determined fitness metrics;
• modifying the selected rule to form an updated rule;
• and
• repeating running the updated rule on the labeled data, determining fitness metrics of the updated rule, and mutating the updated rule.